main · last commit
18 hours ago ·
8tmadfpi
spec-ejq.1 Consolidate owner+agents read predicate into one Principal.CanRead()
Past Stand
bd reopen spec-ejq.1
| Created by | Eugene Blikh |
| Owner | bigbes@gmail.com |
| Created | 2026-07-24T16:45:16Z |
| Started | 2026-07-24T16:57:49Z |
| Updated | 2026-07-24T16:59:34Z |
| Closed | 2026-07-24T16:59:34Z |
graph/server.go:161, web/handlers.go:61 and now mcpsrv.Gate each hand-spell 'IsOwner() || IsAgent()'. graph.gate's own comment warns two read surfaces with two policies is how a corpus leaks — there are now three copies. Add authn.Principal.CanRead() and route all three through it so the policy is defined once. Low-risk mechanical refactor; deferred out of spec-jjo to keep that bug fix surgical.
spec-ejq
— spec.sr.ht — reviewable document storage for humans and agents
parent-child
open
Nothing depends on this issue.
| id | spec-ejq.1 |
| content_hash | 7c5d8191e17d0c0c294994181f94e0489a8777921f147faceb5f3730098337c5 |
| title | Consolidate owner+agents read predicate into one Principal.CanRead() |
| description | graph/server.go:161, web/handlers.go:61 and now mcpsrv.Gate each hand-spell 'IsOwner() || IsAgent()'. graph.gate's own comment warns two read surfaces with two policies is how a corpus leaks — there are now three copies. Add authn.Principal.CanRead() and route all three through it so the policy is defined once. Low-risk mechanical refactor; deferred out of spec-jjo to keep that bug fix surgical. |
| design | |
| acceptance_criteria | |
| notes | |
| status | closed |
| priority | 4 |
| issue_type | task |
| assignee | Eugene Blikh |
| estimated_minutes | NULL |
| created_at | 2026-07-24T16:45:16Z |
| created_by | Eugene Blikh |
| owner | bigbes@gmail.com |
| updated_at | 2026-07-24T16:59:34Z |
| closed_at | 2026-07-24T16:59:34Z |
| closed_by_session | |
| external_ref | NULL |
| spec_id | |
| compaction_level | 0 |
| compacted_at | NULL |
| compacted_at_commit | NULL |
| original_size | NULL |
| sender | |
| ephemeral | 0 |
| wisp_type | |
| pinned | 0 |
| is_template | 0 |
| mol_type | |
| work_type | |
| source_system | |
| metadata | �{} |
| source_repo | |
| close_reason | authn.Principal.CanRead() defined once; graph.gate, web.mayRead, mcpsrv.Gate routed through it. coreauth left independent (different semantic). Unit test covers owner/agent true, anon/zero/unknown false. Commit pending push. |
| event_kind | |
| actor | |
| target | |
| payload | |
| await_type | |
| await_id | |
| timeout_ns | 0 |
| waiters | |
| hook_bead | |
| role_bead | |
| agent_state | |
| last_activity | NULL |
| role_type | |
| rig | |
| due_at | NULL |
| defer_until | NULL |
| no_history | 0 |
| started_at | 2026-07-24T16:57:49Z |
| is_blocked | 0 |
| id | cf380fdd-be76-5892-b949-3cfb6db80b65 |
| issue_id | spec-ejq.1 |
| type | parent-child |
| created_at | 2026-07-24T19:45:15Z |
| created_by | Eugene Blikh |
| metadata | �{} |
| thread_id | |
| depends_on_issue_id | spec-ejq |
| depends_on_wisp_id | NULL |
| depends_on_external | NULL |
| id | 019f9504-4ff9-71f0-99e6-f4ecb18a35b1 |
| issue_id | spec-ejq.1 |
| event_type | created |
| actor | Eugene Blikh |
| old_value | |
| new_value | |
| comment | NULL |
| created_at | 2026-07-24T19:45:15Z |
| id | 019f950f-ceba-7c44-a1be-2d446fb75666 |
| issue_id | spec-ejq.1 |
| event_type | claimed |
| actor | Eugene Blikh |
| old_value | {"id":"spec-ejq.1","title":"Consolidate owner+agents read predicate into one Principal.CanRead()","description":"graph/server.go:161, web/handlers.go:61 and now mcpsrv.Gate each hand-spell 'IsOwner() || IsAgent()'. graph.gate's own comment warns two read surfaces with two policies is how a corpus leaks — there are now three copies. Add authn.Principal.CanRead() and route all three through it so the policy is defined once. Low-risk mechanical refactor; deferred out of spec-jjo to keep that bug fix surgical.","status":"open","priority":4,"issue_type":"task","owner":"bigbes@gmail.com","created_at":"2026-07-24T16:45:16Z","created_by":"Eugene Blikh","updated_at":"2026-07-24T16:45:16Z"} |
| new_value | {"assignee":"Eugene Blikh","status":"in_progress"} |
| comment | NULL |
| created_at | 2026-07-24T19:57:48Z |
| id | 019f9511-6765-7a54-b5ac-1c081434f0cf |
| issue_id | spec-ejq.1 |
| event_type | closed |
| actor | Eugene Blikh |
| old_value | |
| new_value | authn.Principal.CanRead() defined once; graph.gate, web.mayRead, mcpsrv.Gate routed through it. coreauth left independent (different semantic). Unit test covers owner/agent true, anon/zero/unknown false. Commit pending push. |
| comment | NULL |
| created_at | 2026-07-24T19:59:33Z |
No comments.
Close reason